(CISM) General Flashcards

Which of the following BEST describes the purpose of a Recovery Time Objective (RTO)?

Answer: The target time within which a business process must be restored after disruption

RTO defines how quickly a business process must be restored to avoid unacceptable consequences, driving recovery design and investment.

What distinguishes a Recovery Point Objective (RPO) from a Recovery Time Objective (RTO)?

Answer: RPO measures acceptable data loss in time; RTO measures recovery speed

RPO defines the maximum tolerable data loss window (e.g., last 4 hours of transactions), while RTO defines how quickly systems must be back online.

An organization wants to ensure its Business Continuity Plan (BCP) remains effective over time. The BEST way to accomplish this is to:

Answer: Test, review, and update the BCP on a regular schedule

Regular testing, review, and updates ensure the BCP reflects current systems, personnel, and threats, maintaining its effectiveness as conditions change.

Which of the following is an example of a detective information security control?

Answer: Intrusion detection system (IDS) alerting on suspicious activity

Detective controls like IDS identify and alert on events that have occurred or are occurring, enabling response without preventing the activity itself.

An information security manager wants to verify that security controls are operating as intended. Which activity is MOST appropriate?

Answer: Conducting a control effectiveness audit or assessment

Control effectiveness audits verify that implemented controls are functioning correctly and actually reducing risk as designed.

Which framework is MOST commonly used to align information security management with overall IT governance?

Answer: COBIT (Control Objectives for Information and Related Technologies)

COBIT provides a comprehensive IT governance and management framework that aligns IT activities, including security, with enterprise objectives.

A security manager is asked to measure the return on security investment (ROSI). Which component is ESSENTIAL to calculate ROSI?

Answer: Annualized Loss Expectancy (ALE) before and after implementing controls

ROSI is calculated by comparing ALE before and after control implementation against the cost of those controls, quantifying the financial value of the investment.